[jira] [Resolved] (PDFBOX-6242) XFDF export allows characters illegal in XML 1.0

["Maruan Sahyoun (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/PDFBOX-6242?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Maruan Sahyoun resolved PDFBOX-6242.
------------------------------------
    Resolution: Fixed

> XFDF export allows characters illegal in XML 1.0
> ------------------------------------------------
>
>                 Key: PDFBOX-6242
>                 URL: https://issues.apache.org/jira/browse/PDFBOX-6242
>             Project: PDFBox
>          Issue Type: Bug
>          Components: PDModel
>    Affects Versions: 2.0.37, 3.0.8 PDFBox, 4.0.0
>            Reporter: Maruan Sahyoun
>            Assignee: Maruan Sahyoun
>            Priority: Minor
>             Fix For: 2.0.38, 3.0.9 PDFBox, 4.0.0
>
>
> XFDF export is intended to produce XML 1.0-safe output but has two gaps:
>  * C0 control characters (e.g. 0x00–0x08, 0x0B, 0x0C, 0x0E–0x1F) are not filtered. They're written verbatim since they aren't one of the five escaped special characters. These code points are outside the legal Char production in the XML 1.0 spec, and per the XML errata, a numeric character reference to an illegal code point (e.g. ) is equally non-well-formed — so there's no fix by escaping alone; these characters must be rejected, stripped, or replaced.
>  * The method iterates by UTF-16 char, not by Unicode code point. Supplementary-plane characters are represented as surrogate pairs in Java; each surrogate half is > 0x7e and gets emitted as its own &#N; reference, where N falls in 0xD800–0xDFFF. Surrogate values are explicitly excluded from the legal Char range, so this also produces non-well-formed XML.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: dev-help@pdfbox.apache.org